The REA Iceberg: How AI Agents Really Read Machine Code

You type one sentence into Claude Code: "Explain what this function does." And your agent explains a compiled program it has never seen the source code of. But what actually happens underneath? Let's dive down the REA iceberg, level by level, from the MCP server all the way to Ghidra's P-code. Chapters 0:00 Above the water: the promise of REA 0:26 Level 1: REA is just the adapter 0:59 Level 2: Ghidra becomes a server 1:59 Level 3: a fingerprint on every answer 2:49 Level 4: Ghidra is two programs 3:45 Level 5: auto-analysis, a chain reaction 4:38 Level 6: the decompiler's magic tricks 5:33 Level 7: the bottom, P-code 6:32 Back to the surface: EDA, how you find out how software works 7:29 Outro What's inside - REA runs as an MCP server in Claude Code (~60 modules, 170 tools) - It launches Ghidra headless in a throwaway read-only project and injects a 3,820-line Java bridge script that turns Ghidra into a local socket server - Every answer is an evidence record with a content-hash ID (same question, same answer, same ID), tagged observed / derived / inferred - Ghidra = Java application + a separate C++ decompiler process (that's why rea doctor checks the native decompiler binary) - Auto-analysis as a chain reaction, and the "never returns" trap (REA's NoReturnFix script, disabled on Windows) - Decompiler tricks: dead-flag cleanup, division by 7 via the magic constant 0x92492493, control-flow structuring and the goto of shame - SLEIGH and P-code: one small language for every CPU Links - REA: https://github.com/morluto/rea - Ghidra: https://github.com/NationalSecurityAgency/ghidra Tested with REA 6.4.0 and Ghidra 12.1.4 on Windows.